Double Free by Using Only Safe Rust

[GeorgeAndrou]

Hello,

We are @purseclab, and we are fuzzing Rust crates to identify memory violation bugs. Although we are aware that this crate is unmaintained, we noticed on crates.io that it is still being downloaded. Therefore, we decided to report a memory violation bug we discovered.

The PoC below causes a double-free memory violation.

PoC:

fn main (){
    let slice_deque = slice_deque::from_elem(String::from("DF"), 10);
    let iter1 = slice_deque::SliceDeque::into_iter(slice_deque);
    let iter2 = &iter1.clone();
}

Bug Description:

We believe this bug is caused by slice_deque::IntoIter::clone, which creates a new iterator, iter2, without invalidating or deallocating the existing iterator, iter1. As a result, both iterators point to the same elements. If these elements implement the Drop trait, a double-free memory violation occurs when the iterators go out of scope.

How to Build and Run the PoC:

cargo +1.77.0-x86_64-unknown-linux-gnu run

Output:

free(): double free detected in tcache 2
Aborted (core dumped) 

Details:

• Compiler Version: rustc 1.77.0-stable (aedd173a2 2024-03-17)
• Library Version: slice-deque-0.3.0
• OS: Ubuntu 22.04.5 LTS